Exploitation Summary
EIP tracks 4 public exploits for CVE-2017-16994. PoCs published by Google Security Research, anonymous, jedai47.
AI-analyzed exploit summary This exploit demonstrates an information leak vulnerability in the Linux kernel's mincore system call when handling VM_HUGETLB VMAs. It triggers uninitialized memory disclosure by repeatedly calling mincore on a large anonymous hugepage mapping.
Description
The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call.
Exploits (4)
This exploit demonstrates an information leak vulnerability in the Linux kernel's mincore system call when handling VM_HUGETLB VMAs. It triggers uninitialized memory disclosure by repeatedly calling mincore on a large anonymous hugepage mapping.
This exploit leverages CVE-2017-16994 to bypass KASLR and disable mmap_min_addr protections, followed by a null pointer dereference to achieve privilege escalation via shellcode execution. It requires a custom kernel module (/proc/test) to trigger the vulnerability.
This exploit leverages an information leak vulnerability (CVE-2017-16994) in the Linux kernel's handling of MAP_HUGETLB mappings. It uses mincore to trigger uninitialized memory disclosure, revealing kernel addresses to bypass KASLR.
This repository contains a proof-of-concept exploit for CVE-2017-16994, which involves bypassing KASLR and disabling mmap_min_addr to achieve local privilege escalation via a null pointer dereference in the Linux kernel.
References (13)
Scores
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N